# TopFlow

**Repository Path**: CPLiu/TopFlow

## Basic Information

- **Project Name**: TopFlow
- **Description**: TopFlow is a security-focused visual workflow builder for creating AI-powered applications. 
- **Primary Language**: Unknown
- **License**: MIT
- **Default Branch**: main
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-04-02
- **Last Updated**: 2026-04-06

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# GitHub Security Scanner by Former CISO

<div align="center">

[![Live Scanner](https://img.shields.io/badge/🚀_Try_Scanner-30_Seconds-brightgreen?style=for-the-badge)](https://topflow.dev/builder?template=github-security-scanner)
[![Built by CISO](https://img.shields.io/badge/Built_by-Former_CISO-blue?style=for-the-badge)](https://topflow.dev/about)
[![GitHub Stars](https://img.shields.io/github/stars/csupenn/topflow?style=for-the-badge&color=yellow)](https://github.com/csupenn/topflow/stargazers)
[![License](https://img.shields.io/badge/License-MIT-blue?style=for-the-badge)](LICENSE)
[![Security](https://img.shields.io/badge/Security-A+-green?style=for-the-badge)](https://topflow.dev/docs/security)

<img src="public/demo-assets/images/github-security-dashboard.webp" alt="GitHub Security Scanner Dashboard" width="100%">

**Analyze any GitHub repository's security posture in 30 seconds**

Powered by [TopFlow](https://topflow.dev) - Secure AI Workflow Platform

[🎯 Scan facebook/react](https://topflow.dev/builder?template=github-security-scanner&repo=facebook/react) • [📖 How It Works](https://topflow.dev/docs) • [⭐ Star on GitHub](https://github.com/csupenn/topflow)

</div>

---

## 🔍 Live Example: facebook/react

**Score**: 95/100 (Grade: **A+**) ⭐

<table>
<tr>
<td width="50%">

**✅ Security Excellence**
- Active security policy & code scanning
- Dependabot monitoring enabled
- Branch protection rules enforced
- Secret scanning active

**📊 Vulnerability Status**
- 0 critical, 1 high, 3 medium, 7 low

</td>
<td width="50%">

**🎯 OWASP Compliance**
- 8 of 10 controls passing
- Code coverage: 87%
- Documentation: 92%

**🔐 Best Practices**
- GPG commit signing recommended
- SAST scanning suggested

</td>
</tr>
</table>

**Try it yourself** → [Scan any repo in 30 seconds](https://topflow.dev/builder?template=github-security-scanner)

**No signup. No API keys required (demo mode active).**

---

## 🚀 What You Get in 30 Seconds

<table>
<tr>
<td width="50%">

### 📊 Comprehensive Security Analysis

**Automated Checks**:
- ✅ OWASP Top 10 compliance
- ✅ Vulnerability detection (all severities)
- ✅ Dependency audit & license risks
- ✅ Security best practices scorecard
- ✅ Code quality metrics
- ✅ Branch protection analysis

**AI-Powered Insights**:
- Contextualized recommendations
- Priority-ranked action items
- Effort estimates for fixes
- Impact analysis

</td>
<td width="50%">

### 🎯 Shareable Reports

**Export Options**:
- 📄 Markdown report
- 📋 JSON data (CI/CD ready)
- 🏆 Security badges
- 🔗 Deep links (pre-filled scanner)

**Social Sharing**:
- 🐦 Twitter (pre-formatted)
- 💼 LinkedIn (rich text)
- 📎 One-click copy

**Example Badge**:

[![Security Score](https://img.shields.io/badge/Security-A+-green)](https://topflow.dev)

</td>
</tr>
</table>

**👉 [Scan Your Repository Now](https://topflow.dev/builder?template=github-security-scanner)**

---

## 🔒 Built by Former CISO - Security You Can Trust

This isn't just another GitHub scanner. It's built with **enterprise-grade security architecture** by someone who understands the stakes.

**Why Trust This Scanner?**

<table>
<tr>
<td>✅ **Privacy-First**<br/>All analysis runs client-side (zero data sent to servers)</td>
<td>✅ **BYOK Model**<br/>Use your own API keys (or try demo mode)</td>
</tr>
<tr>
<td>✅ **No Tracking**<br/>Zero analytics, zero data collection</td>
<td>✅ **Open Source**<br/>Audit the code yourself on GitHub</td>
</tr>
<tr>
<td>✅ **Production Code**<br/>Export TypeScript for your own tools</td>
<td>✅ **5-Layer Security**<br/>Defense-in-depth architecture</td>
</tr>
</table>

**Built by**: [Charlie Su](https://charliesu.com), Former CISO

---

## 💡 This is a TopFlow Template

**GitHub Security Scanner is 1 of 8 pre-built security workflows** running on the TopFlow platform.

### Explore More Security Templates

<table>
<tr>
<td width="33%" align="center">
<a href="https://topflow.dev/builder?template=github-security-scanner">
🔍<br/>
<b>GitHub Security Scanner</b><br/>
<sub>Repository security analysis</sub><br/>
<sub>✅ You just tried this!</sub>
</a>
</td>
<td width="33%" align="center">
<a href="https://topflow.dev/builder?template=gdpr-data-access">
🛡️<br/>
<b>GDPR Compliance</b><br/>
<sub>Automate data access requests</sub><br/>
<sub>Article 15 workflow</sub>
</a>
</td>
<td width="33%" align="center">
<a href="https://topflow.dev/builder?template=pii-detection">
🔐<br/>
<b>PII Detection</b><br/>
<sub>Scan for sensitive data</sub><br/>
<sub>Privacy-preserving pipeline</sub>
</a>
</td>
</tr>
<tr>
<td width="33%" align="center">
<a href="https://topflow.dev/builder?template=incident-response">
🚨<br/>
<b>Incident Response</b><br/>
<sub>SOC automation workflow</sub><br/>
<sub>Threat analysis with AI</sub>
</a>
</td>
<td width="33%" align="center">
<a href="https://topflow.dev/builder?template=soc2-evidence">
📋<br/>
<b>SOC 2 Evidence</b><br/>
<sub>Compliance automation</sub><br/>
<sub>Audit trail generation</sub>
</a>
</td>
<td width="33%" align="center">
<a href="https://topflow.dev/builder?template=vulnerability-scan">
🐛<br/>
<b>Security Templates</b><br/>
<sub>+3 more workflows</sub><br/>
<sub>View all in builder</sub>
</a>
</td>
</tr>
</table>

**All templates include**:
- ✅ Instant demo mode (no API keys needed)
- ✅ Export to production TypeScript
- ✅ Visual workflow editor
- ✅ Security-first architecture

**Want to build your own?** → [Launch TopFlow Builder](https://topflow.dev/builder)

---

## ⚡ Why TopFlow is Different

**The Problem:** Current AI workflow builders store your data, require subscriptions, and lock you into their platforms.

**TopFlow's Solution:** Built by a former CISO with security as the #1 priority:

<table>
<tr>
<td>✅ <b>Zero Data Storage</b><br/>Your workflows never touch our servers</td>
<td>✅ <b>BYOK Model</b><br/>Use your own API keys</td>
</tr>
<tr>
<td>✅ <b>Export to Code</b><br/>Generate production TypeScript</td>
<td>✅ <b>Security First</b><br/>SSRF protection, sandboxing, rate limiting</td>
</tr>
</table>

### Who Uses TopFlow?

- **🏢 Security Teams**: Automate compliance checks and incident response
- **👨‍💻 Indie Hackers**: Add AI features without vendor lock-in
- **🏭 Enterprises**: Build secure internal AI tools
- **🎓 Educators**: Teach secure AI architecture patterns
- **🔬 Researchers**: Experiment with AI workflows safely

## 🎨 Build Custom Security Workflows

TopFlow is a **visual workflow platform** designed for security professionals.

**What Makes TopFlow Different**:

<table>
<tr>
<td width="50%">

### 🔒 Security-First Architecture

**5-Layer Defense Model**:
1. **Client-Side**: XSS prevention, input sanitization
2. **Transport**: TLS 1.3, HSTS headers
3. **API Gateway**: Rate limiting, DDoS protection
4. **Execution**: SSRF prevention, sandboxed JS
5. **External APIs**: BYOK model, no shared secrets

**Built by Former CISO**:
- OWASP Top 10 coverage built-in
- Threat modeling at design time
- Defense-in-depth patterns
- Compliance-conscious (GDPR, SOC 2, HIPAA)

</td>
<td width="50%">

### 🛡️ Privacy-Preserving Design

**Zero Data Storage**:
- All workflows stored in browser localStorage
- No backend database
- No server-side data processing
- Zero data breach risk

**BYOK Model**:
- Use your own AI provider keys
- Keys never sent to our servers
- No ongoing API costs for platform

**GDPR Compliant**:
- Data sovereignty (you own 100%)
- No tracking or analytics
- Right to be forgotten (clear browser data)

</td>
</tr>
</table>

---

### How TopFlow Compares

| Feature | TopFlow | Other Platforms |
|---------|---------|-----------------|
| **Data Storage** | 🟢 None (localStorage only) | 🔴 Cloud databases |
| **Privacy** | 🟢 100% client-side | 🔴 Server-side processing |
| **API Keys** | 🟢 Your own (BYOK) | 🔴 Platform-managed |
| **Code Export** | 🟢 Production TypeScript | 🔴 JSON/Config only |
| **Vendor Lock-in** | 🟢 None | 🔴 Proprietary formats |
| **Cost** | 🟢 Free (MIT License) | 🔴 Monthly subscriptions |
| **Security** | 🟢 5-layer defense | 🔴 Basic protection |
| **Built By** | 🟢 Former CISO | 🔴 SaaS companies |

---

## 🎥 See It In Action

<div align="center">

<!-- Replace with actual workflow execution GIF -->
<img src="public/demo-assets/images/placeholder-landscape.webp" alt="TopFlow Workflow Demo" width="80%">

**Build → Validate → Execute → Export Code**

</div>

---

## ✨ Features That Make Us Different

### 🔒 **Privacy-First Architecture**
```yaml
Your Data: Stored in your browser (localStorage)
Our Servers: Never see your data or API keys
Result: Zero data breach risk
```

### 🛡️ **5-Layer Security Model**
Every request passes through comprehensive security controls:
1. **Client-Side**: Input sanitization, XSS prevention
2. **Transport**: TLS 1.3, HSTS headers
3. **API Gateway**: Rate limiting, DDoS protection
4. **Execution**: SSRF prevention, sandboxed JavaScript
5. **External APIs**: BYOK model, no shared secrets

### 🤖 **Production-Ready Code Export**
```typescript
// Your workflow becomes real code:
export async function runWorkflow(input: string) {
  const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY })

  const prompt = `Analyze: ${input}`
  const result = await client.chat.completions.create({
    model: "gpt-4-turbo",
    messages: [{ role: "user", content: prompt }]
  })

  return result.choices[0].message.content
}
```

---

## 🏆 What's Included

### Pre-Built Security & Compliance Workflows

<table>
<tr>
<td width="50%">

**📋 GDPR Compliance Suite**
- ✅ Article 15: Data Access Requests
- ✅ Article 17: Right to Erasure
- ✅ Article 20: Data Portability
- ✅ Article 33: Breach Notification
- ✅ Article 35: Privacy Impact Assessment
- ✅ Automated compliance reporting

</td>
<td width="50%">

**🚨 Security Automation**
- ✅ Incident Response Workflows
- ✅ Threat Intelligence Analysis
- ✅ Security Log Analysis with AI
- ✅ Vulnerability Assessment
- ✅ SOC 2 Evidence Collection
- ✅ PII Detection & Redaction

</td>
</tr>
</table>

### Enterprise-Ready Features

- **🔒 5-Layer Security Model**: Defense-in-depth architecture
- **🛡️ SSRF Protection**: Comprehensive URL validation
- **⚡ Rate Limiting**: 10 req/min protection
- **🔐 Sandboxed Execution**: Safe JavaScript runtime
- **📊 Audit Trails**: Complete execution logging
- **🎯 OWASP Top 10**: Full coverage built-in

---

## 🚀 Quick Start

### Option 1: Try the GitHub Scanner (30 Seconds)

```bash
# No installation needed - just click:
https://topflow.dev/builder?template=github-security-scanner&repo=facebook/react

# Or scan your own repo:
https://topflow.dev/builder?template=github-security-scanner&repo=YOUR_USERNAME/YOUR_REPO
```

**Demo mode active** - No API keys required for initial testing.

---

### Option 2: Run TopFlow Locally (5 Minutes)

```bash
# Clone and install
git clone https://github.com/csupenn/topflow.git
cd topflow
pnpm install

# Start development server
pnpm dev

# Open http://localhost:3000
```

**What you get**:
- ✅ Full workflow builder
- ✅ All 8 security templates
- ✅ Code export functionality
- ✅ Local demo mode (no API keys needed)

---

### Option 3: Use in Your Projects (Advanced)

```bash
# Install the workflow core package
npm install @charliesu/workflow-core
```

```typescript
import { validateWorkflow, executeWorkflow } from '@charliesu/workflow-core'

// Use TopFlow's validation and execution engine
// in your own applications
```

**Use cases**:
- CI/CD security scanning
- Automated compliance checks
- Custom security tooling
- Internal workflow automation

---

## 🛠️ Technology Stack

<table>
<tr>
<td><img src="https://img.shields.io/badge/Next.js-15-black?style=flat-square&logo=next.js" alt="Next.js"></td>
<td><img src="https://img.shields.io/badge/React-19-blue?style=flat-square&logo=react" alt="React"></td>
<td><img src="https://img.shields.io/badge/TypeScript-5.9-blue?style=flat-square&logo=typescript" alt="TypeScript"></td>
<td><img src="https://img.shields.io/badge/Tailwind-4.0-38bdf8?style=flat-square&logo=tailwindcss" alt="Tailwind"></td>
</tr>
<tr>
<td><img src="https://img.shields.io/badge/Vercel_AI_SDK-5.0-orange?style=flat-square" alt="AI SDK"></td>
<td><img src="https://img.shields.io/badge/ReactFlow-12-purple?style=flat-square" alt="ReactFlow"></td>
<td><img src="https://img.shields.io/badge/shadcn/ui-latest-black?style=flat-square" alt="shadcn"></td>
<td><img src="https://img.shields.io/badge/Zustand-5.0-brown?style=flat-square" alt="Zustand"></td>
</tr>
</table>

### Supported AI Providers

<table>
<tr>
<td align="center"><b>OpenAI</b><br/>GPT-4, GPT-3.5</td>
<td align="center"><b>Anthropic</b><br/>Claude 3</td>
<td align="center"><b>Google</b><br/>Gemini Pro</td>
<td align="center"><b>Groq</b><br/>Fast Inference</td>
</tr>
</table>

---

## 📊 Why Developers Love TopFlow

<table>
<tr>
<td align="center">
<h3>⚡</h3>
<b>30 Seconds</b><br/>
<sub>From idea to working workflow</sub>
</td>
<td align="center">
<h3>🎯</h3>
<b>Zero Setup</b><br/>
<sub>Demo mode works instantly</sub>
</td>
<td align="center">
<h3>🔐</h3>
<b>100% Private</b><br/>
<sub>Your data never leaves browser</sub>
</td>
<td align="center">
<h3>💻</h3>
<b>Export Code</b><br/>
<sub>Production TypeScript, not JSON</sub>
</td>
</tr>
</table>

---

## 📖 Documentation

- 📚 **[Architecture Overview](docs/architecture/architecture-overview.md)** - System design & security model
- 🎓 **[Quick Start Guide](https://topflow.dev/docs/learn/quick-start)** - Get running in 5 minutes
- 🔧 **[Node Reference](https://topflow.dev/docs/build/nodes)** - All 12 node types explained
- 🛡️ **[Security Documentation](https://topflow.dev/docs/security)** - Threat model & controls
- 🧪 **[Testing Guide](TESTING.md)** - 437 tests, 95% coverage

---

## 🌟 Community & Support

<table>
<tr>
<td align="center">
<a href="https://github.com/csupenn/topflow/discussions">
<img src="https://img.shields.io/badge/Discussions-Join-blue?style=for-the-badge&logo=github">
</a>
</td>
<td align="center">
<a href="https://github.com/csupenn/topflow/issues">
<img src="https://img.shields.io/badge/Issues-Report-red?style=for-the-badge&logo=github">
</a>
</td>
<td align="center">
<a href="https://twitter.com/charliesu_ai">
<img src="https://img.shields.io/badge/Twitter-Follow-1DA1F2?style=for-the-badge&logo=twitter">
</a>
</td>
</tr>
</table>

### 🆕 Recent Updates & Milestones

- 🔍 **v1.4.0** (Jan 2026) - GitHub Security Scanner with instant demo mode
- 🎉 **v1.3.0** (Jan 2026) - Published @charliesu/workflow-core npm package
- 📝 **v1.2.0** (Jan 2025) - Added GDPR Article 15-35 workflows
- 🚀 **v1.1.0** (Jan 2025) - WebP optimization (97.7% size reduction)
- 🛡️ **v1.0.0** (Dec 2024) - Initial release with 12 node types
- 📊 **8 security templates** - Enterprise-ready workflows
- ⭐ **Growing fast** - Join 1,000+ security-conscious developers

---

## 🤝 Contributing

We welcome contributions! Especially:

- 🛡️ Security improvements
- 📋 Compliance workflows
- 🔧 New node types
- 📚 Documentation
- 🧪 Test coverage

See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

---

## 📈 Project Stats

<table>
<tr>
<td align="center">
<b>8</b><br/>
<sub>Security Templates</sub>
</td>
<td align="center">
<b>12</b><br/>
<sub>Node Types</sub>
</td>
<td align="center">
<b>5</b><br/>
<sub>Security Layers</sub>
</td>
<td align="center">
<b>1</b><br/>
<sub>Former CISO</sub>
</td>
<td align="center">
<b>100%</b><br/>
<sub>Privacy-First</sub>
</td>
</tr>
</table>

---

## 📄 License

**MIT License with Commons Clause** - see the [LICENSE](LICENSE) file for details.

**✅ You CAN:**
- Use for any purpose (commercial or personal)
- Modify and customize
- Export and own generated code
- Fork and distribute

---

## 🎯 Start with the Scanner, Explore the Platform

<div align="center">

### GitHub Security Scanner is your gateway to secure AI workflows

<a href="https://topflow.dev/builder?template=github-security-scanner">
<img src="https://img.shields.io/badge/🔍_Scan_Any_Repo-Try_Now-brightgreen?style=for-the-badge&labelColor=black" alt="Try Scanner" height="50">
</a>

<br/><br/>

### ⭐ **Love the scanner? Star us on GitHub!**

Your star helps other security teams discover these tools.

<a href="https://github.com/csupenn/topflow">
<img src="https://img.shields.io/github/stars/csupenn/topflow?style=social" alt="GitHub stars">
</a>

<br/>

[![Star History Chart](https://api.star-history.com/svg?repos=csupenn/topflow&type=Date)](https://star-history.com/#csupenn/topflow&Date)

</div>

---

<div align="center">
<sub>Built with ❤️ by <a href="https://charliesu.com">Charlie Su</a> • Former CISO • AI Security Advocate</sub>
<br/>
<sub>🔒 Security-first architecture • 🎯 Privacy by design • 🚀 No vendor lock-in</sub>
<br/>
<sub>📧 Contact: <a href="mailto:charlie@topflow.dev">charlie@topflow.dev</a> • 💼 <a href="https://linkedin.com/in/charliesu">LinkedIn</a></sub>
</div>